CVE-2024-0095: nvidia nvidia triton inference server Improper Output Neutralization for Logs

Vulnerability summary

CVE-2024-0095 is a high (CVSS 7.2) Improper Output Neutralization for Logs vulnerability in nvidia nvidia triton inference server. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities.

Timeline

1. 13-06-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands by injecting arbitrary data as a new log entry. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

• CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.